HP-UX Directory Server 8.1 administrator guide

Server does not include a client application for the password change extended operation. However,
the ldappasswd utility can be used as follows:
ldappasswd -h hostname -p secure_port -Z -P /path/to/cert8.db -D bindDN
-w bindPassword [-a oldPassword] -s newPassworduser
Table 7-2 ldappasswd options
DescriptionOption
Gives the host name of the Directory Server.
-h
Gives the port number of the Directory Server. Because SSL is required for password change
operations, this is usually give the TLS/SSL port of the Directory Server. With the -ZZ or -ZZZ
for Start TLS, this can be the standard port.
-p
Requires SSL for the connection. A secure connection is required for the password change
operation.
NOTE:
ldappasswd also supports Start TLS encryption (-ZZ[Z]).
-Z
Gives the full path to the certificate database that contains the CA certificate of the CA that issued
the Directory Server client certificate. If the ldappasswd command is run on the same machine
that the Directory Server is installed on, this can be
/etc/opt/dirsrv/slapd-instance_name/cert8.db. If this is not given, the default is
the current directory.
-P
Gives the bind DN.
-D
Gives the password for the bind DN.
-w
Optional. Gives the old password, which is being changed.
-a
Sets the new password.
-s
To use Start TLS, which runs the command on a non-secure port, run ldappasswd with the
-ZZ option and the standard LDAP port number. The password extended change operation has
the following format:
ldappasswd -h hostname -p standard_port -ZZ -P /path/to/cert8.db -D bindDN
-w bindPassword -s newPassworduser [-a oldPassword]
Use the -ZZZ for additional certificate host name validation.
To modify an entry's password, run ldappasswd like any other LDAP operation. It is not
necessary to specify a user if the account is the same as that given in the bind DN. For example:
ldappasswd -h ldap.example.com -p 389 -ZZ
-D "uid=jsmith,ou=People,dc=example,dc=com"
-w secret -s newpassword
To change the password on an entry other than the one specified in the bind credentials, run
ldappasswd as shown below, adding the user DN to the operation and providing separate
credentials, as follows:
ldappasswd -h server.example.com -p 389 -ZZ -D "cn=Directory Manager"
-w secret -s newpassword "uid=jsmith,ou=People,dc=example,dc=com"
Access control is enforced for the password change operation. If the bind DN does not have
rights to change the specified password, the operation will fail with an Insufficient rights
error.
7.1.4 Configuring the account lockout policy
The lockout policy works in conjunction with the password policy to provide further security.
The account lockout feature protects against hackers who try to break into the directory by
repeatedly trying to guess a user's password. The password policy can be set so that a specific
user is locked out of the directory after a given number of failed attempts to bind.
7.1 Managing the password policy 301